What is Nmap?
What is Nmap?
What is Nmap? Nmap is a powerful software that performs network scanning and discovery. If we consider what can be done with Nmap; nmap is used to discover open ports, services running on open ports, operating systems, devices running on systems and to discover security vulnerabilities on these devices/services. Nmap sends packets to the destination during the discovery phase, showing that the ports are open, closed, or filtered.
You can check out the links below and download them:
https://nmap.org/
https://github.com/nmap/nmap
How is Nmap used?
Nmap comes on Kali Linux, but if you want to install it on another system, you can check out the links I gave. You can run nmap-h or nmap-help on the terminal to browse the Nmap help page.
When you run the command above, the output is as below. Here is information about the parameters used when performing nmap scanning.
Get Stoicdailydose’s stories in your inbox
Join Medium for free to get updates from this writer.
Nmap commands
I will not take all the nmap commands in the article and make an in-depth use. Already the description of the nmap parameters is in the command output, I will scan a vulnerable machine and show the discovery phase.
- sn: means to do a port scan.
-n: means to do DNS Resolution.
-v, -vv, -vvv: Increases the details to be displayed on the screen.
-F: Scans faster. Finds fewer results.
-sS: Scan for Syn.
–reason: Shows the reason for a result found.
–open: Shows only open Ports.
-p-: Scans all 65535 ports possible on an IP.
-sV: Tries to find out what service is running on the open port. It works if used with -sC.
-sC: Uses nmap scripts when versioning with -sV.
-p: Scans only the ports specified after this parameter.
–top-ports: scans the most used ports.
The Nmap Discovery Phase
For this scan, I will use the Typhoon v1.02 machine as the target.
First I will find the IP address of the machine. To find the IP address of the machine, I first learn my own IP address (192.168.204.134) then I will find the target machine address by exploring the devices in the same host using the nmap command below.
nmap -sn 192.168.204.0/24
This option tells Nmap not to run a port scan after the host discovery and to print only existing hosts that respond to the scan. This is often known as a “ping scan,” but you can also ask to run traceroute and NSE host scripts.
I set the target machine IP address as 192,168,204,135. Then I scan for TCP SYN scanning (-SS) and the 10 most used ports (-top-ports 10) with the following command. We can add the -p-parameter to scan all ports.
nmap -sS — top-ports 10 192.168.204.135
After discovering the 10 most used ports, we can discover the services running on these ports and list the vulnerabilities found in these services if any. With the following command, I will again discover a TCP SYN scan (-SS), the 10 most used ports (-top-ports 10), and the services running on those ports (-SV). We can also combine the parameters used here (nmap-SSV).
nmap -sS -sV — top-ports 10 192.168.204.135
We learned about the services that work on the ports as seen above. In a penetration test, the target system can be captured by starting from the vulnerabilities found in these services. We can use the (-O) parameter for operating system discovery in the target system. We can include the scan with the command below.
nmap -sS -sV -O — top-ports 10 192.168.204.135
Then we need to detect the vulnerabilities in the services running on the ports we discovered as a result of nmap scanning. For this, we can use different ways such as google search and searchsploit. However, we can easily do this by using NSE scripts in nmap.
The Nmap Scripting Engine (NSE) is one of Nmap’s most powerful and flexible features. Allows users to write (and share) simple scripts. (Using the Lua programming language)
The tasks we have in mind when building the system include network discovery, more complex version detection, vulnerability detection. NSE can even be used to exploit the vulnerability.
To reflect these different uses and simplify the selection of scripts to run, each script contains a field that associates it with one or more categories. Currently defined categories are auth, default. discovery, dos, exploit, external, fuzzer, intrusive, malware, safe, version and vuln. All of this is explained at http://nmap.org/book/nse-usage.html#nse-categories.
